73 lines
4 KiB
Markdown
73 lines
4 KiB
Markdown
|
# Security Layer Model — flex-auth conformance record
|
||
|
|
|
||
|
|
> **Derived artifact** (§11). Derives from
|
||
|
|
> `net-kingdom/canon/standards/security-layer-model_v0.8.md`
|
||
|
|
> (`status: proposed`, `source_revision: gate-house@516ed4e`).
|
||
|
|
> Derived at: **2026-09-21**. Maintained by `flex-auth`.
|
||
|
|
|
||
|
|
This file exists because `INTENT.md` deliberately does not carry one. The layer
|
||
|
|
declaration states a **boundary** — flex-auth is Engine / PDP — and a boundary
|
||
|
|
does not change when the standard text is amended. Conformance state does change,
|
||
|
|
every revision, and belongs in an artifact that is expected to move and that
|
||
|
|
carries the version it was derived at.
|
||
|
|
|
||
|
|
The split is the standard's own. Its frontmatter: *"`assented_by` records assent
|
||
|
|
to a BOUNDARY, given at the version named. It is not assent to the current text."*
|
||
|
|
|
||
|
|
## Declaration
|
||
|
|
|
||
|
|
| Field | Value |
|
||
|
|
| --- | --- |
|
||
|
|
| Layer | `Engine` |
|
||
|
|
| Role | `PDP` — the estate's only policy decision point (§6) |
|
||
|
|
| Declared at | 2026-08-29 |
|
||
|
|
| Declared by | `FLEX-DEC-2026-001`, `FLEX-DEC-2026-002`, `FLEX-DEC-2026-003` |
|
||
|
|
| PEP stance | `null` — not PEP-shaped; flex-auth renders decisions and causes no protected side effect |
|
||
|
|
| Tooling contacts | none — §5 binds Staff; flex-auth holds no Tooling client |
|
||
|
|
|
||
|
|
## Assent history
|
||
|
|
|
||
|
|
Assent is to the boundary, recorded at the version where it was given.
|
||
|
|
|
||
|
|
| Version | Record | Outcome |
|
||
|
|
| --- | --- | --- |
|
||
|
|
| v0.4 | `FLEX-DEC-2026-002` | §9.3 contested and upheld |
|
||
|
|
| v0.6 | `FLEX-DEC-2026-003` | review; §6.4.2, §9.7.2, §17 adopted into v0.7 |
|
||
|
|
| v0.7 | — | four flex-auth findings adopted |
|
||
|
|
| v0.8 (`proposed`) | `FLEX-DEC-2026-011` | assent with four findings, all adopted |
|
||
|
|
|
||
|
|
## Conformance state at v0.8
|
||
|
|
|
||
|
|
**Conforming, with declared gaps below.** §11's four states: conforming,
|
||
|
|
blocked-clean, declared gap, undeclared violation. flex-auth claims no
|
||
|
|
blocked-clean capability and holds no undeclared violation it is aware of.
|
||
|
|
|
||
|
|
| # | Gap | Owner | Blocked on | Review |
|
||
|
|
| --- | --- | --- | --- | --- |
|
||
|
|
| G1 | Registry-snapshot digest absent from decision provenance. §9.7.2 promotes it to a conformance prerequisite: a decision that turned on registry content must be replayable from its own record. | `flex-auth` | implementation | `FLEX-WP-0019` |
|
||
|
|
| G2 | **Emission guarantee not declared.** §11 requires every §4 repository catalogued as a source of evidence to declare class, cadence and detection surface in its machine-readable declaration, and says a source declaring none is not conforming. flex-auth declares none. | `gate-house` to rule, then `flex-auth` | whether flex-auth is a §4 *source of evidence* or only the producer of an artifact `audit-core` sources — see `FLEX-WP-0030` B3 | `FLEX-WP-0030-T04` |
|
||
|
|
| G3 | Published stance-register review is stale: written at two register rows, §13.1 now carries five, and its Finding 1 was ruled by v0.8 §6.4 obligation 3. | `flex-auth` | second edition | `FLEX-WP-0029` |
|
||
|
|
|
||
|
|
G2 is recorded as a gap rather than as conformance because the flattering reading
|
||
|
|
— that `audit-core` is the source and flex-auth merely produces — has not been
|
||
|
|
confirmed by anyone but flex-auth. §11 says a source that declares no emission
|
||
|
|
guarantee is not conforming; until the boundary is ruled, the conservative entry
|
||
|
|
is the honest one.
|
||
|
|
|
||
|
|
## Not gaps
|
||
|
|
|
||
|
|
- **No standard version in `INTENT.md`.** Deliberate, enforced by test
|
||
|
|
(`internal/layer`), and raised to `gate-house` as `FLEX-WP-0030` B4 in case §11
|
||
|
|
should say so generally.
|
||
|
|
- **Canon says `access-engine`, the repository answers to `flex-auth`.** The
|
||
|
|
rename is ruled (`FLEX-DEC-2026-013`) and sequenced (`FLEX-WP-0020`); the
|
||
|
|
coordinate is pending, not broken. Raised as B5.
|
||
|
|
|
||
|
|
## How this file is kept true
|
||
|
|
|
||
|
|
`internal/layer` asserts that `INTENT.md` carries no `standard_version` and names
|
||
|
|
a `conformance_record` that exists on disk. That is the same property flex-auth
|
||
|
|
praised in `ops-warden`'s stance map: the published artifact is asserted equal to
|
||
|
|
the shipped one by test, rather than merely written down. It does **not** assert
|
||
|
|
the contents below the declaration — a reviewer still has to read this file.
|